CVE-2026-59306: CWE-502 Deserialization of Untrusted Data in Spring Spring Cloud Stream

This vulnerability (CVE-2026-59306) concerns the deserialization of untrusted types in Spring Cloud Stream, potentially allowing unsafe data handling. The affected versions are Spring Cloud Stream 4.2.0 to 4.2.6, 4.3.0 to 4.3.3, and 5.0.0 to 5.0.2. The CVSS v3.1 base score is 3.1, indicating low severity, with network attack vector, high attack complexity, requiring high privileges and user interaction, and resulting in low confidentiality and integrity impacts without availability impact. There is no vendor advisory or patch information available at this time, and no known active exploitation has been reported.

The impact is limited to potential confidentiality and integrity loss due to unsafe deserialization of untrusted data in affected Spring Cloud Stream versions. The low CVSS score reflects that exploitation requires high privileges and user interaction, and the attack complexity is high. There is no known availability impact. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when processing untrusted data with affected versions of Spring Cloud Stream. No specific vendor mitigation or workaround is currently documented.